The following are post-install instructions to help you configure
RWP for IIS:
Important Notes (Please Read First):
-Installing to a drive other than C:\ is NOT recommended.
-All permissions must be set this explicitly. RWP will not function
properly unless all permissions are set according to the following
instructions. For example, using the "Everyone" group
will not work for the IRWP_WEBPOSTER account as it is set-up specially
by the installer.
-In configurations involving Active Directory or sites that have
security policies that require the use of 'strong' passwords;
you must create an alternate local account on the web server and
configure DCOM to use that account.
- If an alternate account is necessary, it must be created with
sufficient rights to the server [directory security, registry,
system policies], use the following to set up the account as the
run-time account for DCOM. In the following instructions, substitute
your Alternate account name when it says IRWP_WEBPOSTER. As The
'IRWP_WEBPOSTER' account that the RWP 1.2 installer creates is
modeled after the 'IWAM_machinename' it is recommended that the
new alternate account must have the same system policies (e.g.
'Log on Locally') as that of the 'IWAM_machinename'.
Directories (Right-Click, Properties, Security)
R = Read, X = Execute, W = Write, FC = Full Control
| Directory: |
Account |
Permissions |
| C:\Program Files\WebPoster |
IRWP_WEBPOSTER
IUSR_machinename |
(RX)
(RX) |
| C:\Program Files\WebPoster\Databases |
IRWP_WEBPOSTER |
(RXW) |
Additional Notes:
- Make sure that the directory permissions at the WebPoster directory
are set to allow inheritance (under ADVANCED) to child directories
and files.
Virtual Directories (Internet Service Manager or MMC, Expand
Server, Expand Default Web Site, Right-click on RIS, Select Properties)
- Virtual Directory Tab: If, under the Application Settings,
there's a button named CREATE then click on it. If not (or it's
grayed out) just continue with the following: Name should be blank,
"Run in Isolated Memory Space" should be checked, and
Permissions should be set for Execute.
- Directory Security Tab: Click on the first EDIT button on the
screen. Of the three options checked here, only Anon access should
be checked. The anon access account for this directory should
still be IUSR_MACHINENAME not the IRWP account.
DCOM (Start, Run, dcomcnfg, RISWSrvr.Application, Properties,
Identity Tab)
Set RWP's status to OFF before proceeding:
"This user" should be set to one of the following:
- If the machine is a Domain Controller then regardless of any
other aspects in the domain the account should be set to: \IRWP_WEBPOSTER
- If the machine is a Member Server then the account should be
set to MACHINENAME\IRWP_WEBPOSTER
- If the password fields are blank then they need to be set.
Registry (Start, Run, regedt32 (not regedit))
Editing the Windows Registry should
only be performed by those individuals who are comfortable doing
so. An error created in the Windows registry has the potential
to damage the operating system.
Verify that the permissions for the WebPoster key allow both the
Admin and IRWP accounts full access starting at the Research Information
Systems part of the tree.
- Expand HKEY_LOCAL_MACHINE
- Expand Software
- Go to Research Information Systems and select the SECURITY
menu item.
- Verify that the Admin account (your account) and the IRWP_WEBPOSTER
account have full control over this key.
Additional Notes: If the Directory Security under
the Properties of RIS in IIS is not set to allow anonymous access
(e.g. Windows Integrated), you must give at least Read/Execute permissions
to this key to all user accounts that would be accessing RWP securely.
If inheritance (under ADVANCED) is not present on this key then
the same procedure will be needed for the child keys: Reference
Web Poster, Databases, Reference Lists, Server, User Info.
Additional Issues:
Some verisons of the IIS Lock-down Tool available from Microsoft
install a utility called URLScan.exe. By default, this utility blocks
all HTTP POST commands to the web server. RWP uses POSTS and therefore
will be blocked if the URLScan.exe is left in it's default configurations.
For more information on URLScan or how to configure URLScan please
see Microsoft's Knowledgebase (#326444, #307608) or Microsoft's
TechNet
page regarding this tool
|
